[BUG] nala 'NO_PUBKEY' - fails install about deb-get HOT 4 CLOSED

They've moved their keyfile - hence the 404.
Unless they provide a URL for the public key we'll probably have to deprecate support for nala and recommend their own installer script. Otherwise we'd need to wrap their installer script to get their keyfile deb (as well as the release deb?), but that seems pointless.

[email protected] may know where they key URL is now, if it remains accessible.

from deb-get.

zcat /usr/share/doc/volian-archive-keyring/NEWS.Debian.gz|more
volian-archive (0.3.1) unstable; urgency=medium
  The Scar repo is being replaced by the Nala repo.
  Scar will be reused for another purpose.

  It is recommended to run `apt install volian-archive-nala`
  to make sure it is marked as manually installed.

  Followed by `apt purge volian-archive-scar` to get rid of that.

 -- Blake Lee <[email protected]>  Thu, 09 May 2024 04:04:32 +0000

from deb-get.

Hi I'm the Nala developer,

I figured I would respond here instead of in email, that way others can see the discussion. And my apologies for the slow response.

The key can still be obtained from our Git repo for the archive.
https://gitlab.com/volian/volian-archive/-/blob/main/volian-archive-scar-unstable.gpg?ref_type=heads

As you linked we have changed repositories. Removing the key from the web server was a step taken to figure out those who may be using it outside of the .deb that we provide for the repos.

I have a plan tho, and will create a PR soon to resolve this issue. It is worth noting though that the repository contains updated dependencies for some distros that need them, such as Debian Bullseye, or Ubuntu 20.04. This means just raw dog installing the repo will cause some python libraries to be updated to Sid versions. This does have potential to break system utilities that depend on those same libraries. I have not seen or heard of this happening yet, but it is always a risk.

The archive deb we ship sets up a preferences file that will only pull in Nala from that repo unless you use the apt -t switch to set it as the target release, or if you remove that preferences file. I am not really familiar with deb-get outside of knowing the name, but my understanding is that using it to install Nala in this way would not provide the protections our preferences file does.

from deb-get.

I added the key back to the webserver but named nala.key. This way I can fix it for your users but also keep it broken for anyone else who was using it directly. Now that I know deb-get uses it, I can coordinate any future changes.

from deb-get.